Top Methods Cybercriminals Use to Breach Networks in : A Look at IBM X-Force's Threat Intelligence Report

In 2024, the landscape of cyberattacks remained alarmingly consistent, with cybercriminals continuing to exploit the same tactics to breach organizational networks. IBM X-Force’s annual Threat Intelligence Index revealed a troubling pattern in the methods used by cybercriminals, showing how they rely heavily on identity-based attacks and vulnerabilities in public-facing applications. These tactics not only make attacks harder to detect but also more challenging to mitigate, creating significant risks for organizations across various industries.

Key Takeaways from IBM X-Force’s Findings

IBM

Credential theft, often enabled by phishing emails or infostealers, is a growing problem, with an alarming 84% increase in phishing-driven infostealer attacks observed in 2024. These threats are made even more potent by the availability of vast amounts of stolen credentials on dark web forums, which are then reused or sold to further target unsuspecting organizations.

Furthermore, IBM X-Force highlighted the exploitation of long-standing vulnerabilities in public-facing applications, which still represent a significant vector for initial access. Despite patches being available, many organizations fail to implement timely updates, leaving systems vulnerable to attack. Critical infrastructure industries, such as manufacturing and finance, were particularly hard-hit, underscoring the targeted nature of these attacks.

What Undercode Say:

Cyberattacks are evolving into more stealthy and sophisticated threats, primarily driven by identity-based tactics and long-ignored vulnerabilities. The fact that attackers are increasingly “logging in” rather than “hacking in” marks a major shift in cyberattack methodology. This approach makes detection more difficult as attackers blend into normal network activity, leveraging stolen credentials to bypass traditional security defenses.

The rise in infostealers and credential phishing attacks reflects the growing ease with which cybercriminals can harvest and exploit login details. With phishing techniques becoming more sophisticated, organizations must be more vigilant in detecting these threats before they escalate. Notably, the surge in infostealer attacks—an 84% increase in 2024 alone—shows just how potent and widespread these tactics are, especially considering that the volume of such attacks has continued to climb dramatically into 2025.

Additionally, the exploitation of unpatched vulnerabilities remains a significant problem. Despite years-old vulnerabilities being patched, many organizations still fail to apply updates in time. This negligence is leading to continued successful exploits, as attackers scan for and use known flaws to gain initial access.

When it comes to the industries most affected by these attacks, critical infrastructure remains the primary target, and manufacturing has been the hardest hit sector for the fourth year running. The continued targeting of industries such as finance, energy, and transportation highlights the strategic nature of these attacks. Cybercriminals are not just exploiting any vulnerabilities; they are deliberately going after high-value industries where the impact of a breach can be catastrophic, either in terms of financial loss or operational disruption.

The report also reinforces the importance of strong identity management practices. With valid credentials being reused in multiple attacks, ensuring robust password policies, multi-factor authentication, and employee training on phishing risks is critical. Furthermore, organizations must have up-to-date vulnerability management practices in place, regularly auditing systems and applying patches as soon as they are available to close off potential entry points for attackers.

Lastly, the availability of millions of stolen credentials on dark web forums fuels a thriving underground economy, making it easier for cybercriminals to reuse these details for further attacks. This creates a cyclical problem, where stolen data is recycled and exploited in new ways, creating an ever-growing pool of targets for attackers.

Fact Checker Results

IBM X-Force’s report on cybercrime trends aligns with findings from other cybersecurity experts, showing a clear pattern in the methods attackers are using. The emphasis on identity-based attacks, such as credential theft via phishing and infostealers, is consistent with broader trends observed across the industry. Additionally, the ongoing exploitation of known vulnerabilities in unpatched systems reinforces the importance of proactive vulnerability management practices.